Micronaut Framework versions 4.3.0 through before 4.10.22, 3.10.6, and 3.8.14 contain an uncontrolled resource consumption vulnerability (CWE-400) in the TimeConverterRegistrar component. This component caches DateTimeFormatter instances in an unbounded ConcurrentHashMap keyed by a combination of the @Format annotation pattern and the locale derived from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions, an attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags. This leads to unbounded growth of the cache, exhausting heap memory and causing the JVM to crash. The vulnerability has a CVSS 3.1 base score of 7.5 (High) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. The issue is fixed in versions 4.10.22, 3.10.6, and 3.8.14.

An unauthenticated attacker can cause a denial of service by exhausting JVM heap memory through uncontrolled growth of a cache in the TimeConverterRegistrar component. This results in application crashes and service unavailability. There is no impact on confidentiality or integrity.

A fix is available in micronaut-core versions 4.10.22, 3.10.6, and 3.8.14. Users should upgrade to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No other mitigation steps are indicated.